Which sudoers rule applies least privilege when opsdemo only needs the approved maintenance command?
opsdemo
opsdemo ALL=(root) NOPASSWD:
labex ALL=(root) NOPASSWD: /usr/local/bin/demo-restart-service
opsdemo ALL=(root) NOPASSWD: /usr/local/bin/demo-restart-service
opsdemo ALL=(root) NOPASSWD: ALL